How to Find Users Whose MFA Was Reset in Microsoft Entra ID
Question details
The user needs to generate a historical report or track which users had their Multi-Factor Authentication (MFA) reset during a specific timeframe.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Auditing and managing Multi-Factor Authentication security settings for enterprise users.
- Observed behavior
- Standard MFA reports show current status but lack direct historical logs for MFA reset events during a selected month.
Ensure you have the necessary administrative privileges (such as Global Administrator or Authentication Administrator) in Microsoft Entra ID to access audit logs and modify user authentication methods.
Review Microsoft Entra Audit Logs for MFA Resets
The most reliable way to find historical MFA resets is by filtering the Entra ID Audit Logs for authentication method changes over your desired date range.
Navigate to the Microsoft Entra admin center and log in with your administrative credentials.
In the left-hand navigation pane, expand the Identity menu, click on Users, and then select Audit logs.
Set the Date filter to your desired time range (e.g., the last month). Adjust the Service filter to 'Authentication Methods'.
Look for specific activity entries such as 'Admin deleted security info' or 'User registered security info' to identify accounts that had their MFA reset or reconfigured.
How to Properly Reset MFA for Selected Users
If you need to trigger a new MFA registration for a user, you must clear their existing methods or require re-registration.
Equip Your IT Team with WPS Office
While you manage your organization's Microsoft Entra ID and MFA security, consider WPS Office as a lightweight, highly compatible, and cost-effective alternative to Microsoft Office. It helps IT departments deploy a comprehensive office suite across the organization without the heavy licensing costs.
Frequently Asked Questions
How long are audit logs kept in Microsoft Entra ID?
Microsoft Entra ID stores audit logs for 7 days for organizations with Entra ID Free. If you have Premium P1 or P2 licenses, the logs are retained for 30 days but can be routed to an Azure Storage account or Azure Monitor for much longer retention.
Can I use PowerShell to check for MFA resets?
Yes, you can use the Microsoft Graph PowerShell SDK to query audit logs for MFA-related actions by filtering the DirectoryAudits endpoint for authentication method changes.
Why doesn't the standard MFA report show historical resets?
The standard MFA status report is designed to display the current authentication methods and enforcement status (Enforced, Enabled, Disabled) for users, rather than tracking a chronological history of administrative actions.
